Google calls on governments to be transparent about how & why they request access to citizens’ data

Google has called on international governments to be more transparent about how and why they request access to users’ data stored on the company’s servers.  The call comes as Google issues its latest Transparency Report.

Google’s Transparency Report is the company’s biannual report which details the number and types of requests that governments and judicial systems have made for access to users’ information held by Google.

• Google’s April 2013 Transparency Report
• Google’s November 2012 Transparency Report
• Google’s May 2012 Transparency Report
• Google’s October 2011 Transparency Report
• Google’s June 2011 Transparency Report
• Google’s April 2011 Transparency Report
• Twitter’s 2012 Transparency Report

Google also reiterated its warning from its last Report that governments are becoming increasingly adept at requesting and accessing users’ data, including data from services such as Gmail, Blogger, YouTube, and Google+.  The company says that since 2009 the number of requests has nearly doubled and shows signs of increasing still, a statistic that the Electronic Freedom Foundation called “alarming.”

In Google’s first transparency report of 2013, covering the last six months of 2012, Google reports that more requests are being made to access data stored on its servers.  In today’s release the company also revealed the ways that governments and judiciary used legal methods to access personal data on Google’s servers.

During the six month period from July to December 2012 American authorities requested access to 14,791 users’ accounts – more than the next seven highest countries combined.  India was second and requested access to 4,106 individual accounts.

The US was also the most successful country: of its requests 88% were successful.  The next highest successful percentage rate was Singapore (75%), which requested access to 153 specific accounts.

Country	User Data Requests	Percentage of requests where some data produced	Users/Accounts Specified
United States	8,438	88%	14,791
India	2,431	66%	4,106
France	1,693	44%	2,063
Germany	1,550	42%	1,944
United Kingdom	1,458	70%	1,918
Brazil	1,211	66%	2,526
Italy	846	34%	1,051
Australia	584	65%	711
Spain	447	49%	665
Poland	409	17%	500
South Korea	355	30%	771
Taiwan	290	74%	366
Hong Kong	255	31%	251
Portugal	200	30%	278
Turkey	149	0%	144
Japan	124	62%	149
Belgium	120	63%	153
Argentina	114	38%	175
Chile	109	58%	168
Russia	97	1%	123
Singapore	96	75%	153
Hungary	95	0%	151
Mexico	90	24%	150
Israel	56	59%	66
Czech Republic	51	31%	84
Switzerland	49	67%	59
Canada	38	24%	77
Denmark	34	59%	41
Ireland	—	—	—
Netherlands	—	—	—
Norway	—	—	—
Total	> 21389	66%	> 33634

Richard Salgado, Google’s Law Enforcement and Information Security Legal Director said that, in the US, a majority of the requests for users’ data are made under the 1986 Electronic Communications Privacy Act (ECPA) which allows for access to users’ information stored by third parties.

Salgado explains how the law works in relation to the number of requests made to Google in the last six months of 2012.

• 68 percent of the requests Google received from government entities in the U.S. were through subpoenas. These are requests for user-identifying information, issued under the Electronic Communications Privacy Act (“ECPA”), and are the easiest to get because they typically don’t involve judges.
• 22 percent were through ECPA search warrants. These are, generally speaking, orders issued by judges under ECPA, based on a demonstration of “probable cause” to believe that certain information related to a crime is presently in the place to be searched.
• The remaining 10 percent were mostly court orders issued under ECPA by judges or other processes that are difficult to categorize.

Of the 31 countries listed by Google in its report only three – Norway, Ireland, and The Netherlands – did not request access to users’ data. In previous years these countries had requested access to such data; of these, The Netherlands placed the largest number of requests for users account, 213, in January 2011.

In the wider EU, member states, when combined, made requests to access 8,848 users’ accounts, with France requesting largest amount, 2,063.

With this transparency report Google did not specify how many requests governments made for the removal of users’ data.  The company says that this data will be released at a later point in the year.

Google’s list of countries does not include data relating to some of the most restrictive regimes for Internet access.  None of the 12 countries which Reporters without Borders lists as “Enemies of the Internet,” Bahrain, Belarus, Burma, China, Cuba, Iran, North Korea, Saudi Arabia, Syria, Turkmenistan, Uzbekistan, and Vietnam.